Windows Application Error: LSASS (lsass.exe) Crashed (Event ID 1000)
Alerts on Application Error (Event ID 1000) entries where lsass.exe crashes, using Windows Application event telemetry.
- Product
- windows
- Service
- application
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-12-07
- Updated
- 2026-07-31
ATT&CK techniques
Cred AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows Application Error events (Event ID 1000) where the crashing application is lsass.exe with an exception code of c0000001. A crash in LSASS is security-relevant because it can be used to disrupt credential protections and facilitate credential access workflows. It relies on Windows Application Error telemetry that records the event provider, crashing application name, event ID, and exception code.
Reporting behind it
- github.comhttps://github.com/deepinstinct/Lsass-Shtinkering
- media.defcon.orghttps://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
- learn.microsoft.comhttps://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/application_error/win_application_error_lsass_crash.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Application Error: LSASS (lsass.exe) Crashed (Event ID 1000)"
id: 04cbf1ce-6af3-441e-bd43-74234052beec
status: experimental
description: This rule flags Windows Application Error events (Event ID 1000) where the crashing application is lsass.exe with an exception code of c0000001. A crash in LSASS is security-relevant because it can be used to disrupt credential protections and facilitate credential access workflows. It relies on Windows Application Error telemetry that records the event provider, crashing application name, event ID, and exception code.
references:
- https://github.com/deepinstinct/Lsass-Shtinkering
- https://media.defcon.org/DEF%20CON%2030/DEF%20CON%2030%20presentations/Asaf%20Gilboa%20-%20LSASS%20Shtinkering%20Abusing%20Windows%20Error%20Reporting%20to%20Dump%20LSASS.pdf
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-erref/596a1078-e883-4972-9bbc-49e60bebca55
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/application/application_error/win_application_error_lsass_crash.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-12-07
modified: 2025-12-03
tags:
- attack.credential-access
- attack.t1003.001
logsource:
product: windows
service: application
detection:
selection:
Provider_Name: Application Error
EventID: 1000
AppName: lsass.exe
ExceptionCode: c0000001
condition: selection
falsepositives:
- Rare legitimate crashing of the lsass process
level: high
license: DRL-1.1
related:
- id: a18e0862-127b-43ca-be12-1a542c75c7c5
type: derived